AGREEMENT #A3124 



MEMORANDUM OF AGREEMENT BETWEEN 
THE FLORIDA DEPARTMENT OF CORRECTIONS 

AND 

OPERATION NEW HOPE, INC. 



This Memorandum of Agreement (“Agreement”) is between the Florida Department of Corrections 
(“Department”) and Operation New Hope. Inc. (“Participating Entity”), which are the parties hereto. 

INTRODUCTION 

Whereas, the Participating Entity is seeking a federal grant under a grant announcement by the Bureau of 
Justice Assistance of the Office of Justice Programs, U.S. Department of Justice, which grant is made 
pursuant to the Second Chance Act of 2007 (Public Law 1 10-199); and 

Whereas, the Bureau of Justice Assistance of the Office of Justice Programs, U.S. Department of Justice, has 
issued guidance for the grant at BJA-20 13-3483, directing that a party seeking the grant should obtain an 
official Agreement from a correctional agency such as the Department; and 

Whereas, this Agreement is entered into pursuant to Sections 945.025(1) and 945.04(1), Florida Statutes, which 
collectively set out the Department’s responsibility for the Florida correctional system, including the 
rehabilitation of adult offenders; and 

Whereas, this Agreement furthers the puiposes of the Department in seeking to provide rehabilitation for adult 
offenders. 

Therefore, in consideration of the mutual benefits to be derived by this Agreement, the Department and the 
Participating Entity agree as follows: 



PURPOSE 

The purpose of this Agreement is to establish the general conditions and joint processes that will enable the 
Department and the Participating Entity to collaborate as partners in providing mentoring and transition 
services to inmates as part of the Participating Entity’ s receipt of a grant under the Second Chance Act. 

BACKGROUND 

The objective of this project is to promote successful re-entry of offenders into their communities by 
providing mentoring and re-entry services for offenders that return to Duval, St. Johns, Nassau, and Clay 
Counties upon release from incarceration. The Participating Entity shall identify and provide assistance 
to inmates confined in Florida’s correctional institutions who will return to Duval, St. Johns, Nassau, and 
Clay Counties upon release. 

Research shows that offenders who receive mentoring and re-entry services during pre and post-release 
periods in the re-entry process have a higher likelihood of reintegrating into the community and remaining 
crime free. The re-entry mentoring program will provide offenders with mentoring and re-entry services 
that will contribute to decreased recidivism. 
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The puipose of the mentoring program is to achieve one or more of the following outcomes: 

1. Establish opportunities for inmates to have quality mentoring relationships, which have been proven 
effective measures in lowering recidivism rates. 

2. Address the re -integration service needs of inmates preparing to return to the community. 

3. Contribute to preparing offenders to reintegrate into their communities as lawful and productive 
citizens. 

The Department will follow normal procedure to determine inmate eligibility for mentoring and re-entry 
coordinator visitations. A single point of contact within the Participating Entity will coordinate the 
scheduling of mentoring visitation sessions with the participating facilities. Once both the mentor and 
incarcerated participant are selected by the Participating Entity, they will be given an orientation 
training explaining the intended outcomes and program participation requirements. 

I. TERM OF AGREEMENT 

This Agreement shall begin on the date on which it is signed by both parties, and shall end at midnight 
three (3) years from the date of execution. In the event this Agreement is signed by the parties on 
different dates, the latter date shall control. 

II. SCOPE OF AGREEMENT 

The Department and the Participating Entity agree to carry out their respective duties and 
responsibilities outlined below, subject to controlling law, policy(ies) and/or procedures, and in 
consideration of the mutual interests and understandings expressed herein. 

A. Project Outcomes 

The Participating Entity’s goals include improving life planning skills, improving 
decision-making skills, establishing positive role model community bonds in preparation 
for the inmates release and community reintegration, and providing re-entry planning and 
post release service coordination for offenders. 

B. Department Responsibilities 

The Department will perform the following duties in support of this Agreement, to the 
extent possible within existing resources: 

1. The Department agrees to allow the Participating Entity to conduct its programs at the 
following Department facilities: Baker Correctional Institution, Lawtey Correctional 
Institution, Lowell Correctional Institution, and Dinsmore Work Release Center, during 
the term of this Agreement. Sites may be added or deleted by letter as agreed upon by 
the Participating Entity and the Department and will not require an amendment to this 
Agreement. 

2. The Department agrees to provide data and/or reports to assist the Participating Entity 
with identifying inmates returning to the targeted counties of release. 

3. The Department agrees to support the continuation of mentee/mentor relationships post- 
release. The Department will promote the post-release program by encouraging 
participation and emphasizing the benefits to released offenders during Probation Officer 
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contact periods. The Participating Entity recognizes that absent a court order; offender 
participation cannot be mandated. 

4. The Department agrees to share offender information allowable by statute and/or policy 
with the Participating Entity to facilitate continued contact with the released offender(s). 

5. The Department will allow up to 100 inmates to participate in the re-entry mentoring 
program each calendar year of the Agreement. 

6. The Department will make all reasonable effort to provide the Participating Entity an 
adequate, private meeting space at each facility with room for tables and chairs to 
accommodate all participants. 

7. The Department will assist the Participating Entity in providing adequate and reasonable 
meeting times in order to provide full two-hour visitations with the inmate 
participants. The Department will coordinate with the Participating Entity to 
establish days and times during which inmate participants shall be permitted to 
participate in the Participating Entity’s re-entry mentoring program. The 
Department shall follow all procedures necessary to ensure that inmate participants 
are able to attend on such established days and times. 

8. The Department will provide the Participating Entity and the Control Room at each 
participating facility with a standing Memorandum which lists the materials approved 
by each Warden or his/her designee. 

9. The Department will provide training for the Participating Entity’s volunteers who are 
participating in this project in accordance with Department Procedure 503.004, 
“Volunteers”. 

C. Participating Entity Responsibilities 

The Participating Entity shall perform the following duties in support of this Agreement, to 

the extent possible within existing resources: 

1 . The Participating Entity shall coordinate the scheduling of mentoring sessions with the 
participating facilities. 

2. The Participating Entity shall require each Re-entry Coordinator/staff person that will 
participate in the program at a Department participating facility to complete a state 
background check pursuant to Section VII., Paragraph C. Each Re-entry 
Coordinator/staff person shall agree to follow any and all security guidelines relevant 
to the Department’s requirements and procedures (e.g., Department Procedure 
602.016, “Entering and Exiting Department of Corrections Institutions”). 

3. The Participating Entity shall hold information sessions, upon prior notification and 
approval by the Department’s applicable Warden or his/her designee with eligible 
inmates to explain the program and to distribute information brochures and enrollment 
request forms. 

4. The Participating Entity shall develop standard mentoring programs and protocols for 
activities/curriculum to be used as part of the in-person visitation re-entry mentoring 
program sessions, and provide copies to the participating facilities. These sessions will 
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incorporate best practice research about how to assist inmates in the re-entry process 
through mentoring and life planning. 

5. Subject to the prior approval and inspection of the Warden or his/her designee at a 
Department facility, the Participating Entity’s Re-entry Coordinators/staff may bring 
into any participating facility materials needed to conduct the re-entry mentoring 
program. These materials include but are not limited to: attendance sheets, evaluation 
assessments, CD players, tapes and CD’s, markers, colored pencils, educational 
videotapes, and other educational materials. All materials carried into a Department 
facility by the Participating Entity or any of its Re-entry Coordinators/staff shall remain 
the property of the Participating Entity and/or such Re-entry Coordinators/staff unless 
retained by the Department for a security or other breach. 

6. The Participating Entity shall provide all necessary information to run background 
checks on volunteer mentors of inmates wishing to enter any participating facility. Such 
information shall be provided within five (5) working days prior to the proposed entry of 
such guest to any participating facility. 

7. Because the Participating Entity will be performing services under this Agreement at 
institutional sites, the Participating Entity staff shall be screened and/or tested for 
tuberculosis annually as required by Department Procedure 401.015, Employee 
Tuberculosis Screening and Control Program. 

8. The Participating Entity shall be responsible for obtaining the TB screening/testing. 

9. The Participating Entity shall provide the applicable institutional Senior Registered 
Nurse Supervisor with proof of testing annually. 

10. The Participating Entity shall bear all costs associated with the TB screening/testing. 

11. The Participating Entity shall comply with all legal and contractual requirements 
required of it by the federal government as a recipient of the federal grant that relates to 
this Agreement. 

III. FINANCIAL OBLIGATIONS OF THE PARTIES 

The Department and the Participating Entity acknowledge that this Agreement is not intended to 
create financial obligations as between the parties. However, in the event that costs are incurred as a 
result of either or both of the parties performing their duties or responsibilities under this Agreement, 
each party agrees to be responsible for their own costs. 

The Department and the Participating Entity acknowledge that the services described in this 
agreement are contingent upon grant award funding. Accordingly, in the event that federal grant 
funding is awarded for the purpose of this Agreement, then the Participating Entity shall notify the 
Department in writing within ten (10) days of Participating Entity’s being informed of that decision 
so that the Department is aware this contingency has been met and the Agreement has become 
effective. 

In the event that federal grant funding is not awarded for the purpose of this Agreement, then the 
Participating Entity shall notify the Department in writing within ten (10) days of Participating 
Entity’s being informed of that decision. Said notice shall function as a mutual termination of this 
Agreement, and no further action to terminate the Agreement as contemplated by Section VI below 
will be required of either party. 
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IV. AGREEMENT MANAGEMENT 

A. Department’s Agreement Administrator 

The Operations Manager, Bureau of Contract Management and Monitoring, is designated 
Agreement Administrator for the Department and is responsible for maintaining the official 
Agreement file, processing any amendments or termination of the Agreement, and for 
maintaining records of all formal correspondence between the Department and the 
Participating Entity regarding administration of the Agreement. 

The title, address and telephone number of the Department’s Agreement Administrator is: 

Operations Manager, Contract Administration 

Bureau of Contract Management and Monitoring 

Florida Department of Corrections 

501 South Calhoun Street 

Tallahassee, Florida 32399-2500 

Telephone: (850)717-3681 

Fax: (850)488-7189 

B. Agreement Managers 

The parties have identified the following individuals as Agreement Managers. These 
individuals are responsible for enforcing performance of the Agreement terms and 
conditions and shall serve as liaison/agency contact regarding issues arising out of this 
Agreement. 



FOR THE DEPARTMENT 


FOR OPERATION NEW HOPE, INC. 


Dan Eberlein 


Kevin T. Gay 


Regional Re-Entry Coordinator, Region 
II Office 


President 


P.O. Box 718 


1830 North Main Street 


Fake Butler, Florida 32054-0628 


Jacksonville, Florida 32206 


(386) 496-6000 (telephone) 


(904) 354-4673 (telephone) 


(386) 496-6716 (facsimile) 


(904) 407-3729 (facsimile) 


eberlein.dan@mail.dc.state.fl.us (email) 


kgav @ operationnewhope.com (email) 



V. REVIEW AND MODIFICATION 

A. Upon request of either party, both parties will review this Agreement in order to determine 
whether its terms and conditions are still appropriate. The parties agree to renegotiate terms 
and conditions hereof if it is mutually determined that significant changes in this Agreement 
are necessary. There are no obligations to agree by either party. 

B. Modifications to the provisions of this Agreement, with the exception of Sections II. B. 1. 
and IV., Agreement Management, shall be valid only through execution of a formal written 
amendment to the Agreement. 
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VI. TERMINATION 

This Agreement may be terminated at any time upon the mutual consent of both parties or 
unilaterally by either party upon no less than thirty (30) calendar days’ notice. Notice shall be 
delivered by certified mail (return receipt requested), express mail or other method whereby a receipt 
of delivery may be obtained. 

In addition, this Agreement may be terminated with 24 hours notice by the Department for any 
failure of the Participating Entity to comply with the terms of this Agreement or any applicable 
Florida law. 

VII. OTHER CONDITIONS 

A. Institutional Security 

In carrying out the provisions of this Agreement, the Participating Entity must comply with 
all security procedures for vendors doing business in Department’s facilities as contained in 
Department Procedure 602.016, “Entering and Exiting Department of Corrections 
Institutions”, and the Security Requirements for Contractors, attached hereto and herein 
referred to as Attachment A. 

B. Sovereign Immunity & Indemnification 

Nothing contained in this Agreement constitutes a waiver of sovereign immunity by the 
Department. Further, nothing herein shall be construed as consent by the Department to be 
sued by third parties in any matter arising out of this Agreement or any other contract. 

The Participating Entity shall be liable, and agrees to be liable for, and shall indemnify, 
defend, and hold the Department, its employees, agents, officers, heirs, and assignees 
harmless from any and all claims, suits, judgments, or damages including court costs and 
attorney’s fees arising out of intentional acts, negligence, or omissions by the Participating 
Entity or its employees or agents, in the course of the operations of this Agreement, 
including any claims or actions brought under Title 42 USC §1983, the Civil Rights Act. 

C. Background Checks 

The Participating Entity’ s staff assigned to this Agreement and any other person performing 
services pursuant thereto shall be subject, at the Department's discretion and expense, to a 
Florida Department of Law Enforcement (FDLE) Florida Crime Information 
Center/National Crime Information Center (FCIC/NCIC) background/criminal records 
check. This background check will be conducted by the Department and may occur or re- 
occur at any time during the Agreement period. The Department has full discretion to 
require the Participating Entity to disqualify, prevent, or remove any staff from any work 
under the Agreement. The use of criminal history records and information derived from 
such records checks are restricted pursuant to Section 943.054, F.S. The Department shall 
not disclose any information regarding the records check findings or criteria for 
disqualification or removal to the Participating Entity. The Department shall not confirm to 
the Participating Entity the existence or nonexistence of any criminal history record 
information. In order to carry out this records check, the Participating Entity shall provide, 
to the institution(s) at which the program is offered, prior to the performance of any services 
under this Agreement, the following data for any individual contractor or subcontractor’s 
staff assigned to the Agreement: Full Name, Race, Gender, Date of Birth, Social Security 
Number, Driver’s License Number and State of Issue. If requested, the Participating 
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Entity’ s staff shall submit to fingerprinting by the Department of Corrections for submission 
to the Federal Bureau of Investigation (FBI). The Participating Entity shall not consider new 
employees to be on permanent status until a favorable report is received by the Department 
from the FBI. 

D. Confidentiality 

The Participating Entity shall ensure all staff assigned to this Agreement maintains 
confidentiality with reference to individual participants receiving services in accordance 
with applicable local, state, and federal laws, rules and regulations. The Department and the 
Participating Entity agree that all information and records obtained in the course of 
providing services under this Agreement shall be subject to confidentiality and disclosure 
provisions of applicable federal and state statutes and regulations adopted pursuant thereto. 

The Participating Entity agrees to keep all Department personnel information (i.e., DC staff 
telephone numbers, addresses, etc.) strictly confidential and shall not disclose said 
information to any person, unless released in writing by said Department. 

E. Disputes 

Any dispute concerning performance of the terms of this Agreement shall be resolved 
informally by the Agreement Managers. Any dispute that cannot be resolved informally 
shall be reduced to writing and delivered to the Department’s Director of Re-Entry Programs 
and Education. The Director of Re-Entry Programs and Education shall decide the dispute, 
reduce the decision to writing, and deliver a copy to the parties, the Agreement Managers 
and the Agreement Administrator. 

F. Data Sharing 

The Department and the Participating Entity acknowledge their separate obligations to store 
and disseminate data in compliance with the requirements of Public Records Law, Chapter 
119, Florida Statutes, and with other applicable statutes that constitute express exceptions to 
the requirements of Section 119.07(1), Florida Statutes, by making certain categories of 
records confidential, exempt from disclosure, or accessible as prescribed by statute. The 
Participating Entity acknowledges that the data exchanged between them has been provided 
for official purposes and that public access to such data is limited and prescribed by statute. 
The Participating Entity therefore agrees, consistent with public records law, to refer third 
parties requesting delivery of information to the originating party. Participating Entity 
further agrees to disseminate data only in compliance with confidentiality restrictions and in 
recognition of the exemptions from disclosure provided by law and to provide advance 
copies of documents involving the other party's data for review to determine if there has 
been an inadvertent disclosure of confidential information as described herein prior to 
publication. 

G. Notices 



All notices required or permitted by this Agreement shall be given in writing and by hand- 
delivery or email to the respective addresses of the parties with the exception of Section VI 
above. All notices by hand-delivery shall be deemed received on the date of delivery and all 
notices by email shall be deemed received when they are transmitted and not returned as 
undelivered or undeliverable. Either party may change the names, addresses, or telephone 
numbers set forth in Section IV above by written notice given to the other party as provided 
above. 
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H. Health Insurance Portability and Accountability Act 

The Participating Entity shall comply with the Health Insurance Portability and Accountability 
Act of 1996 ( 42 U. S. C. 1320d-8) , and all applicable regulations promulgated thereunder. Such 
compliance shall be required by the execution of Attachment B, Business Associate Agreement. 



REMAINDER OF THIS PAGE INTENTIONALLY LEFT BLANK 
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AUTHORIZATION FOR SIGNATURE 

IN WITNESS THEREOF, the parties hereto have caused this Agreement to be executed by their undersigned 
officials as duly authorized. 




DEPARTMENT OF CORRECTIONS 




SIGNED 

BY: 




Approved as to fomi and legality, subject 
to execution: 

SIGNED h ' Crj , 

BY: L 


NAME: 


Michael D. Crews 


NAME: ^^fermifer A. Parker 


TITLE: 


Secretary 

Department of Corrections 

/ / 


TITLE: General Counsel 

Department of Corrections 


DATE: 


>/vyp 


DATE: •SMd 
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Firm Representing: Operation New Hope, Inc. 



Name of Employ ee/Vendor: 

(Print) 



DEPARTMENT OF CORRECTIONS 
SECURITY REQUIREMENTS FOR CONTRACTORS 



(1) FS 944.47: Except through regular channels as authorized by the officer -in-charge of the correctional 
institution, it is unlawful to introduce into or upon the grounds of any state correctional institution, or to 
take or attempt to take or send or attempt to send therefrom any of the following articles, which are 
hereby declared to be contraband. 

(a) Any written or recorded communication or any currency or coin given or transmitted, or intended 
to be given or transmitted, to any inmate of any state correctional institution. 

(b) Any article of food or clothing given or transmitted, or intended to be given or transmitted, to any 
inmate of any state correctional institution. 

(c) Any intoxicating beverage or beverage which causes or may cause an intoxicating effect. 

(d) Any controlled substance or any prescription or nonprescription drug having a hypnotic, 
stimulating or depressing effect. 

(e) Any firearm or weapon of any kind or any explosive substance. (This includes any weapons left in 
vehicles) 

(f) Any cellular telephone or other portable communication device intentionally and unlawfully 
introduced inside the secure perimeter of any state correctional institution without prior 
authorization or consent from the officer in charge of such correctional institution. 

A person who violates any provision of this section as it pertains to an article of contraband described in 
subsections (a), (b), or (f) is guilty of a felony of the third degree. In all other cases, a violation of a 
provision of this section constitutes a felony of the second degree. 

(2) Do not leave keys in ignition locks of motor vehicles. All vehicles must be locked and windows rolled 
up when parked on state property. Wheel locking devices may also be required. 

(3) Keep all keys in your pockets. 

(4) Confirm, with the Institutional Warden, where construction vehicles should be parked. 

(5) Obtain formal identification (driver’s license or non-driver’s license obtained from the Department of 
Highway Safety and Motor Vehicles). This identification must be presented each time you enter or 
depart the institution. 

(6) Absolutely no transactions between contract personnel and inmates are permitted. This includes, but is 
not limited to, giving or receiving cigarettes, stamps, or letters. 

(7) No communication with inmates, verbal or otherwise, is permitted without the authorization of the 
officer-in-charge. 
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(8) Strict tool control will be enforced at all times. Tools within the correctional institution are classified as 
AA. A, or B. Class AA tools are defined as any tool that can be utilized to cut chain link fence fiber or 
razor wire in a rapid and effective manner. Class A tools are defined as those tools which, in their 
present form, are most likely to be used in an escape or to do bodily harm to staff or inmates. Class B 
tools are defined as tools of a less hazardous nature. Every tool is to be geographically controlled and 
accounted for at all times. At the end of the workday, toolboxes will be removed from the compound or 
to a secure area as directed by security staff. You must have two copies of the correct inventory with 
each tool box, one copy will be used and retained by security staff who will search and ensure a proper 
inventory of tools each time the tool box is brought into the facility, the other copy will remain with the 
tool box at all times. Tools should be kept to a minimum (only those tools necessary to complete your 
job). All lost tools must be reported to the Chief of Security (Colonel or Major) immediately. No 
inmate will be allowed to leave the area until the lost tool is recovered. 

(9) Prior approval must be obtained from the Chief of Security prior to bringing any powder-activated tools 
onto the compound. Strict accountability of all powder loads and spent cartridges is required. 

(10) All construction materials will be delivered into the compound on trucks entering through the sallyport 
gate. As the security check of vehicles is an intensive and time consuming (10-15 minutes) process, the 
contractor is requested to minimize the number of deliveries. 

(11) Establish materials storage and working areas with the Warden and/or Chief of Security. 

(12) Control end-of-day construction materials and debris. Construction materials and debris can be used as 
weapons or as a means of escape. Construction material will be stored in locations agreed to by security 
staff and debris will be removed to a designated location. Arrange for security staff to inspect the 
project area before construction personnel leave. This will aid you in assuring that necessary security 
measures are accomplished. 

(13) Coordinate with the Warden and Chief of Security regarding any shutdown of existing systems (gas, 
water, electricity, electronics, sewage, etc.). Obtain institutional approval prior to shutting down any 
existing utility system. Arrange for alternative service (if required) and expeditious re-establishment of 
the shutdown system. 

(14) With the intent of maintaining security upon the institution’s grounds, a background check will be made 
upon all persons employed by the contractor or who work on the project. The department, 
represented by institution’s Warden, reserves the right to reject any person whom it determines 
may be a threat to the security of the institution. 



Signature of Employee/Vendor 



Date 



Signature of Staff Witness 
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BUSINESS ASSOCIATE AGREEMENT 

This Business Associate Agreement supplements and is made a part of this Agreement between the Florida Department of 
Corrections ("Department") and Operation New Hope, Inc. ("Participating Entity"), (individually, a "Party" and collectively 
referred to as "Parties"). 

Whereas, the Department creates or maintains, or has authorized the Contractor to receive, create, or maintain certain Protected 
Health Information (“PHI,”) as that term is defined in 45 C.F.R. §164.501 and that is subject to protection under the Health 
Insurance Portability and Accountability Act of 1996, as amended. (“HIPAA”); 

Whereas, the Department is a “Covered Entity” as that term is defined in the HIPAA implementing regulations, 45 C.F.R. Part 
160 and Part 164, Subparts A, C, and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy 
Rule”) and the Security Standards for the Protection of Electronic Protected Health Information (“Security Rule”); 

Whereas, the Contractor may have access to Protected Health Information in fulfilling its responsibilities under its contract 
with the Department; 

Whereas, the Contractor is considered to be a “Business Associate” of a Covered Entity as defined in the Privacy Rule; 

Whereas, pursuant to the Privacy Rule, all Business Associates of Covered Entities must agree in writing to certain mandatory 
provisions regarding the use and disclosure of PHI; and 

Whereas, the purpose of this Agreement is to comply with the requirements of the Privacy Rule, including, but not limited to, 
the Business Associate contract requirements of 45 C.F.R. § 164.504(e). 

Whereas, in regards to Electronic Protected Health Information as defined in 45 C.F.R. § 160.103, the purpose of this 
Agreement is to comply with the requirements of the Security Rule, including, but not limited to, the Business Associate 
contract requirements of 45 C.F.R. §164. 314(a). 

Now, therefore, in consideration of the mutual promises and covenants contained herein, the Parties agree as follows: 

1. Definitions 

Unless otherwise provided in this Agreement, any and all capitalized terms have the same meanings as set forth in the 
HIPAA Privacy Rule, HIPAA Security Rule or the HITECH Act. Contractor acknowledges and agrees that all 
Protected Health Information that is created or received by the Department and disclosed or made available in any 
form, including paper record, oral communication, audio recording, and electronic display by the Department or its 
operating units to Contractor or is created or received by Contractor on the Department’s behalf shall be subject to this 
Agreement. 

2. Confidentiality Requirements 

A. Contractor agrees to use and disclose Protected Health Information that is disclosed to it by the Department 
solely for meeting its obligations under its agreements with the Department, in accordance with the terms of 
this agreement, the Department's established policies rules, procedures and requirements, or as required by 
law, rule or regulation. 

B. In addition to any other uses and/or disclosures permitted or authorized by this Agreement or required by 
law. Contractor may use and disclose Protected Health Information as follows: 

(1) if necessary for the proper management and administration of the Contractor and to carry out the legal 
responsibilities of the Contractor, provided that any such disclosure is required by law or that Contractor 
obtains reasonable assurances from the person to whom the information is disclosed that it will be held 
confidentially and used or further disclosed only as required by law or for the purpose for which it was 
disclosed to the person, and the person notifies Contractor of any instances of which it is aware in which 
the confidentiality of the information has been breached; 

(2) for data aggregation services, only if to be provided by Contractor for the health care operations of 
the Department pursuant to any and all agreements between the Parties. For purposes of this 

Page 12 of 15 



Revised 06/24/10 




Agreement # A3124 
Attachment B 



Agreement, data aggregation services means the combining of protected health information by 
Contractor with the protected health information received by Contractor in its capacity as a 
Contractor of another covered entity, to permit data analyses that relate to the health care operations 
of the respective covered entities. 

(3) Contractor may use and disclose protected health information that Contractor obtains or creates only 
if such disclosure is in compliance with every applicable requirement of Section 164.504(e) of the 
Privacy relating to Contractor contracts. The additional requirements of Subtitle D of the HITECH 
Act that relate to privacy and that are made applicable to the Department as a covered entity shall 
also be applicable to Contractor and are incorporated herein by reference. 

C. Contractor will implement appropriate safeguards to prevent use or disclosure of Protected Health 
Information other than as permitted in this Agreement. Further, Contractor shall implement administrative, 
physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and 
availability of Electronic Protected Health Information that it creates, receives, maintains, or transmits on 
behalf of the Department. The Secretary of Health and Human Services and the Department shall have the 
right to audit Contractor’s records and practices related to use and disclosure of Protected Health Information 
to ensure the Department's compliance with the terms of the HIPAA Privacy Rule and/or the HIPAA 
Security Rule. 

Further, Sections 164.308 (administrative safeguards). 164.310 (physical safeguards), 164.312 (technical 
safeguards), and 164.316 (policies and procedures and documentation requirements) of the Security Rule 
shall apply to the Contractor in the same manner that such sections apply to the Department as a covered 
entity. The additional requirements of the HITECH Act that relate to security and that are made applicable to 
covered entities shall be applicable to Contractor and are hereby incorporated by reference into this BA 
Agreement. 

D. Contractor shall report to Department any use or disclosure of Protected Health Information, which is not in 
compliance with the terms of this Agreement as well as any Security incident of which it becomes aware. 
Contractor agrees to notify the Department, and include a copy of any complaint related to use, disclosure, or 
requests of Protected Health Information that the Contractor receives directly and use best efforts to assist the 
Department in investigating and resolving such complaints. In addition. Contractor agrees to mitigate, to the 
extent practicable, any harmful effect that is known to Contractor of a use or disclosure of Protected Health 
Information by Contractor in violation of the requirements of this Agreement. 

Such report shall notify the Department of: 

1) any Use or Disclosure of protected health information (including Security Incidents) not permitted 
by this Agreement or in writing by the Department; 

2) any Security Incident; 

3) any Breach, as defined by the HITECH Act; or 

4) any other breach of a security system, or like system, as may be defined under applicable State law 
(Collectively a “Breach”). 

Contractor will without unreasonable delay, but no later than seventy-two (72) hours after discovery of a 
Breach, send the above report to the Department. 

Such report shall identify each individual whose protected health information has been, or is reasonably 
believed to have been, accessed, acquired, or disclosed during any Breach pursuant to 42 U.S.C.A. § 
17932(b). Such report will: 

1) Identify the nature of the non-permitted or prohibited access, use, or disclosure, including the nature 
of the Breach and the date of discovery of the Breach. 

2) Identify the protected health information accessed, used or disclosed, and provide an exact copy or 
replication of that protected health information. 

3) Identify who or what caused the Breach and who accessed, used, or received the protected health 
information. 

4) Identify what has been or will be done to mitigate the effects of the Breach; and 

5) Provide any other information, including further written reports, as the Department may request. 
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E. In accordance with Section 164.504(e)(l)(ii) of the Privacy Rule, each party agrees that if it knows of a 
pattern of activity or practice of the other party that constitutes a material breach of or violation of the other 
party’s obligations under the BA Agreement, the non-breaching party will take reasonable steps to cure the 
breach or end the violation, and if such steps are unsuccessful, terminate the contract or arrangement if 
feasible. If termination is not feasible, the party will report the problem to the Secretary of Health and 
Human Services (federal government). 

F. Contractor will ensure that its agents, including a subcontractor, to whom it provides Protected Health 
Information received from, or created by Contractor on behalf of the Department, agree to the same 
restrictions and conditions that apply to Contractor, and apply reasonable and appropriate safeguards to 
protect such information. Contractor agrees to designate an appropriate individual (by title or name) to 
ensure the obligations of this agreement are met and to respond to issues and requests related to Protected 
Health Information. In addition. Contractor agrees to take other reasonable steps to ensure that its 
employees’ actions or omissions do not cause Contractor to breach the terms of this Agreement. 

G. Contractor shall secure all protected health information by a technology standard that renders protected 
health information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or 
endorsed by a standards developing organization that is accredited by the American National Standards 
Institute and is consistent with guidance issued by the Secretary of Health and Human Services specifying 
the technologies and methodologies that render protected health information unusable, unreadable, or 
indecipherable to unauthorized individuals, including the use of standards developed under Section 
3002(b)(2)(B)(vi) of the Public Health Service Act, pursuant to the HITECH Act, 42 U.S.C.A. § 300jj-ll, 
unless the Department agrees in writing that this requirement is infeasible with respect to particular data. 
These security and protection standards shall also apply to any of Contractor’s agents and subcontractors. 

H. Contractor agrees to make available Protected Health Information so that the Department may comply with 
individual rights to access in accordance with Section 164.524 of the HIPAA Privacy Rule. Contractor agrees 
to make Protected Health Information available for amendment and incorporate any amendments to Protected 
Health Information in accordance with the requirements of Section 164.526 of the HIPAA Privacy Rule. In 
addition. Contractor agrees to record disclosures and such other information necessary, and make such 
information available, for purposes of the Department providing an accounting of disclosures, as required by 
Section 164.528 of the HIPAA Privacy Rule. 

I. The Contractor agrees, when requesting Protected Health Information to fulfill its contractual obligations or 
on the Department’s behalf, and when using and disclosing Protected Health Information as permitted in this 
contract, that the Contractor will request, use, or disclose only the minimum necessary in order to accomplish 
the intended purpose. 

3. Obligations of Department 

A. The Department will make available to the Business Associate the notice of privacy practices (applicable to 
offenders under supervision, not to inmates) that the Department produces in accordance with 45 C.F.R. 
164.520, as well as any material changes to such notice. 

B. The Department shall provide Business Associate with any changes in, or revocation of, permission by an 
Individual to use or disclose Protected Health Information, if such changes affect Business Associate’s 
permitted or required uses and disclosures. 

C. The Department shall notify Business Associate of any restriction to the use or disclosure of Protected Health 
Information that impacts the business associate’s use or disclosure and that the Department has agreed to in 
accordance with 45 C.F.R. 164.522 and the HITECH Act. 

4. Termination 

A. Termination for Breach - The Department may terminate this Agreement if the Department determines that 
Contractor has breached a material term of this Agreement. Alternatively, the Department may choose to 
provide Contractor with notice of the existence of an alleged material breach and afford Contractor an 
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opportunity to cure the alleged material breach. In the event Contractor fails to cure the breach to the 
satisfaction of the Department, the Department may immediately thereafter terminate this Agreement. 

B. Automatic Termination - This Agreement will automatically terminate upon the termination or expiration of 
the original contract between the Department and the Contractor. 

C. Effect of Termination 

(1) Termination of this agreement will result in termination of the associated contract between the 
Department and the Contractor. 

(2) Upon termination of this Agreement or the contract. Contractor will return or destroy all PHI 
received from the Department or created or received by Contractor on behalf of the Department that 
Contractor still maintains and retain no copies of such PHI; provided that if such return or 
destruction is not feasible. Contractor will extend the protections of this Agreement to the PHI and 
limit further uses and disclosure to those purposes that make the return or destruction of the 
information infeasible. 

5. Amendment - Both parties agree to take such action as is necessary to amend this Agreement from time to time as is 
necessary to comply with the requirements of the Privacy Rule, the HIPAA Security Rule, and the HITECH Act. 

6. Interpretation - Any ambiguity in this Agreement shall be resolved to permit the Department to comply with the 
HIPAA Privacy Rule and/or the HIPAA Security Rule. 

7. Indemnification - The Contractor shall be liable for and agrees to be liable for, and shall indemnify, defend, and hold 
harmless the Department, its employees, agents, officers, and assigns from any and all claims, suits, judgments, or 
damages including court costs and attorneys’ fees arising out or in connection with any non-permitted or prohibited 
Use or Disclosure of PHI or other breach of this Agreement, whether intentional, negligent or by omission, by 
Contractor, or any sub-contractor of Contractor, or agent, person or entity under the control or direction of Contractor. 
This indemnification by Contractor includes any claims brought under Title 42 USC §1983, the Civil Rights Act. 

8. Miscellaneous - Parties to this Agreement do not intend to create any rights in any third parties. The obligations of 
Contractor under this Section shall survive the expiration, termination, or cancellation of this Agreement, or any and 
all other contracts between the parties, and shall continue to bind Contractor, its agents, employees, contractors, 
successors, and assigns as set forth herein for any PHI that is not returned to the Department or destroyed. 
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